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(57) ABSTRACT 

A circuit having a fingerprint for identification of a particular 
instantiation of the circuit is disclosed. The circuit may 
include a plurality of digital circuits or gates. Each of the 
digital circuits or gates is responsive to a configuration volt- 
age applied to its analog input for controlling whether or not 
the digital circuit or gate performs its intended digital func- 
tion and each of the digital circuits or gates transitioning 
between its functional state and its at least one other state 
when the configuration voltage equals a boundary voltage. 
The boundary voltage varies between different instantiations 
of the circuit for a majority of the digital circuits or gates and 
these differing boundary voltages serving to identify (or fin- 
gerprint) different instantiations of the same circuit. 
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FINGERPRINTED CIRCUITS AND METHODS 
OF MAKING AND IDENTIFYING THE SAME 

CROSS REFERENCE TO RELATED 

APPLICATIONS 5 

This application is a U.S. divisional application of U.S. 
patent application Ser. No. 10/584,592, filed on Sep. 1 1 , 2007 
now U.S. Pat. No. 7,996,737 and incorporated herein by 
reference in its entirety. This application is also related to U.S . ^ ^ 
patent application Ser. No. 10/526,613 entitled “Methods of 
Camouflaging the Functions of Electronic Circuits” and filed 
on Apr. 18, 2005, the disclosure of which is hereby incorpo- 
rated herein by reference. 

GOVERNMENT CONTACT INFORMATION 

This invention was made under NASA contract NAS7- 
03001 and therefore the government has certain rights in this 
technology. 

TECHNICAL FIELD 

Described is a method by which variations due to manu- 
facturing tolerances can be used to uniquely identify a fabri- 25 
cated Integrated Circuit (IC). The disclosed techniques can be 
used to fingerprint even non-integrated circuits or circuits 
employing a plurality of ICs arranged in a desired configura- 
tion. Using the disclosed technology one instantiation of a 
circuit can be readily distinguished from another instantiation 
of the same functionally identical or equivalent circuit. 

BACKGROUND OF THE INVENTION 

Identification techniques are well known in the art. For 35 
example, an IC can be fabricated with fused links or a pro- 
grammable read only memory (ROM), that are programmed 
after the IC is manufactured, to thereby imbed a serial number 
in the IC. However, the serial number is easily readable in 
such prior art devices and moreover it is relatively easy to 40 
replicate the IC with the same imbedded serial number. 

Fingerprinting is different. Fingerprints can be read, but 
they cannot (or virtually cannot) be replicated. The present 
invention relates to fingerprinting an IC, for example, so that 
it can be uniquely identified compared to other ICs made at 45 
the same time even using common masks and/or semicon- 
ductor dies. 

The present invention can be used to fingerprint even non- 
integrated circuits or circuits employing a plurality of ICs 
arranged in a desired configuration. 50 

BRIEF DESCRIPTION OF THE INVENTION 

In one aspect the present invention provides a circuit hav- 
ing a fingerprint for identification of a particular instantiation 55 
of the circuit. The circuit includes a plurality of digital circuits 
or gates, the plurality digital circuits or gates each having an 
analog input and wherein each of said digital circuits or gates 
has at least one functional state wherein the corresponding 
digital circuit or gate performs an intended digital function 60 
and at least one other state wherein said intended digital 
function is not performed, each of said digital circuits or gates 
being responsive to a configuration voltage applied to its 
analog input for controlling whether or not said digital circuit 
or gate performs its intended digital function, each of said 65 
digital circuits or gates transitioning between its functional 
state and its at least one other state when the configuration 
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voltage corresponds to a boundary voltage, the boundary 
voltages varying between different instantiations of said cir- 
cuit for a majority of said digital circuits or gates. The circuit 
also includes a plurality of digital to analog converters for 
generating configuration voltages each applied to one or more 
of said plurality of digital circuits or gates. 

In another aspect the present invention provides a method 
of uniquely identifying instantiations of functionally identi- 
cal circuits. This method includes representing small manu- 
facturing tolerance related differences between particular 
instantiations of the functionally identical circuits as a plu- 
rality of numbers, each number being associated with a par- 
ticular gate or a group of gates of an instantiation of said 
functionally identical circuits; and determining said numbers 
for a particular instantiation of said functionally identical 
circuits, said numbers serving to uniquely identify said par- 
ticular instantiation of said functionally identical circuits. 

DESCRIPTION OF THE FIGURES OF THE 
DRAWING 

FIG. 1 is a block diagram of a gate or circuit which per- 
forms some desired function when an analog control or con- 
figuration voltage applied thereto falls with a particular range 
of voltages. 

FIG. 2 depicts the relationship between the possible values 
of an analog control or configuration voltage A and the func- 
tion performed by gate or circuit. 

FIG. 3 is a pictorial representation of the nominal mini- 
mum value of the analog signal A as shown in relation to four 
hypothetical empirical values measured from other circuits 
IC^-IC^ of identically designed netlists of transistors. 

FIGS. Aa-Ac depict the effect of varying an analog control 
or configuration voltage A for eight polymorphic digital cir- 
cuits fabricated on two separate ICs, chip 1 (FIG. Ad) and chip 
2 (FIG. Ab). The boundaries of functionality were tested and 
are indicated by the regions marked fO . . . fn for chips 1 and 
2. The range of the analog input is shown from 0 volts on the 
left to 1 .8 volts on the right. Hatched regions indicate unde- 
fined or unstable functionality. FIG. Ac is an overlay of FIGS. 
Aa and Ab (without the hatched regions for clarity purposes) 
showing the variability of the starting voltages and ending 
voltages for the respective functions of each of the eight gates. 

FIG. 5 depicts an embodiment where example of a single 
analog control signal wire 14 configures two different digital 
circuits or gates, gO and gl. 

FIG. 6 depicts the different functional ranges for the two 
gates represented in FIG. 5. 

FIG. 7 is similar to FIG. 6 in that it depicts the different 
functional ranges for the two gates represented in FIG. 5, but 
this figure depicts more generalized situation in which the 
boundaries of two different functional regions of two differ- 
ent circuits overlap. 

FIG. 8 depicts example of two different functional regions 
on the same signal wire connected to two different analog- 
configurable digital circuits. Also shown is the difference 
between two different ICs, IC^ and IC^. The dashed lines help 
show how the empirically measured boundaries of the differ- 
ent functional regions are different between different ICs. 

FIG. 9 depicts the functional regions of the two gate 
example for FIG. 5. There are two functional regions here, 
Regl and Reg2. There is a lower and an upper boundary for 
each functional region indicated by Rx^ and Rx^. 

FIG. 10 is a representation of the measurement problem 
with precision given by the hatched number line and the mean 
and sigma shown along that line. 
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FIG. 11 is a graph showing the distribution of boundary 
values around the nominal value for hmctional boundaries. 

FIG. 12 is a block diagram of a six function polymorphic 
gate. 

FIG. 13 is a block diagram of a digital circuit having a 
plurality of black box circuits IO1-IO5 having analog voltages 
supplied by a series of DACs 14^-145. Note that of black box 
circuits IO2 and IO3 are controlled by a common DAC 142&3, 
in the manner described with reference to FIGS. 5-7. 

FIG. 14 is a diagram showing the set of all possible bound- 
ary conditions which could exist, the set of boundary condi- 
tions determined at initial manufacture (the fingerprint of the 
corresponding device or circuit) and the set of boundary 
conditions are tested during a given test when the finger- 
printed device or circuit is being utilized in the field (or 
‘wild’). 

FIG. 15 is a depiction of two gates each having a single 
function f having an associated configured range (Ac^^„ to 

FIG. 16 shows a plot of the likelihood of a distribution with 
the same sigma as the distribution shown in FIG. 11, produc- 
ing two identical fingerprints and plotted as a function of the 
number of boundaries in the system. 

DETAILED DESCRIPTION OF THE INVENTION 

The disclosed method involves the configuring of a digital 
circuit by a vector of analog values, preferably, but not nec- 
essarily, voltage. FIG. 1 depicts a simple circuit or gate (called 
a ‘black box’ as its particular functionality is not important to 
an understanding of the present invention). The black box 
gate or circuit 10 has at least one typically digital input and 
has at least one typically digital output. An analog control 
voltage A is applied to another input of gate or circuit 10. The 
magnitude of the applied voltage A controls the function f (or 
as will be seen, functions fg, f^, . . . f„) which the gate or circuit 
10 performs. When the magnitude of the applied voltage A 
falls within a particular range which the gate or circuit 10 
performs some desired or desirable digital function f. 

The gate or circuit 10 has a feature that when fabricated 
yields a particular digital function of a set of digital inputs (I) 
and digital outputs (Q) when configured correctly with a 
single, or preferably a set, of analog control or configuration 
inputs (A), where I, Q and A are vectors containing a set of 
individual signals. A simple black-box gate might have a 
single analog control or configuration input A, whereas a 
more complex gate or circuit 10 preferably has many control 
or configuration inputs Ag, A^, . . . A^.^ (see FIG. 13 which 
only shows five gates or circuits 10^-105 — a real life complex 
circuit could have hundreds, thousands or even many more 
gates or circuits 10^-10^). 

Each of the analog inputs A are given in the range between 
some minimum value (Ax^^„) and some maximum value 
and each input has a range (Ac„,„ to Ac„^J over 
which the correct circuit function will be exhibited subject to 
the constraint that AC„,„gAx„,.„ and Ac„„^SAx„„^. This 
relationship is shown pictorially by FIG. 2. In FIG. 2 the range 
of the analog configuration signal is shown as the horizontal 
axis with the minimum at and maximum at Ax^^^. This 

axis indicates that for some particular analog configuration 
signal A (an arbitrary signal in the analog configuration vector 
A, numerated as Ag to A^.^ for an m- signal vector) the input 
should not be below the value Ax^^.„ nor above the value 
Ax^^. When the analog configuration or control signal A 
falls in the Ac^j„ to Ac^^, the gate or circuit 10 performs 
some desired function f. When outside that range, the gate or 
circuit 10 performs either a non-desirable function or an 
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indeterminate function. The reference here (and hereinafter) 
to gate or circuit 10 is intended to be general enough to refer 
to the individual blackbox circuits or gates IO1-IO5 of FIG. 13 
and/or to the soon to be described polymorphic gates and 
5 circuits, unless the context dictates otherwise. 

The functioning of an individual gate or circuit (i.e. a group 
of gates) 10 is controlled by the analog voltage A which in 
turn is preferably generated by a Digital to Analog Converter 
(DAC) 12. In order for the individual gate or circuit 10 to 
^ ^ perform a desired function f then its associated DAC 12 must 
produce a voltage which falls in the range of Ac^^^ to Ac^^^. 
In order to determine the magnitude of Ac^,„ and/or Ac^^ 
with some reasonable degree of precision, then DAC 12 must 
^ ^ have a sufficient number of bits to provide a desirable amount 
of resolution. The DAC 12 shown in FIG. 1 is depicted as a 
six -bit DAC, but apart from circuit complexity issues, the 
more precision the DAC 12 has the better since it yields 
greater precision in fingerprinting a particular gate or circuit 
20 10. So six bits here is just exemplary and in all likelihood the 
DAC 12 will have more than six bits in most real world 
applications. Of course, the numbers applied to the various 
DACs to generate their analog output voltages are likewise 
multi-bit numbers. 

25 Individual gates or circuits 10, when manufactured, inher- 
ently have measurable fluctuations in the values of Ac^^„ and 
Ac^^ when measured as chip-to-chip variations for exactly 
the same individual gate or circuit 10 as well as within-chip 
variations for multiple instances of the same circuit topology 
30 which produces gate or circuit 10. On a given chip, for 
example, there may be hundreds of thousands to many mil- 
lions of individual gates. If individual gates or groups of 
individual gates are each controlled by a separate control or 
configuration signal Ag, A^, . . . A^.^, then each of these not 
35 only must fall within its range of Ac^^.„ to Ac^^^ for the 
respective circuits to operate properly, the respective values 
of Ac^^^ and Ac^^^ for each separate control or configuration 
signal Ag, A^, . . . A^.^ each associated with either an indi- 
vidual gate groups of individual gates will serve to uniquely 
40 identify or fingerprint a particular instantiation of a chip (or a 
particular instantiation of a complex circuit comprising a 
thusly configured gates which are not integrated). 

A pictorial representation of the effect of the variance of 
Ac^^„ and Ac^^ is shown in FIG. 3 . In this figure the nominal 
45 minimum value of the analog signal A is shown in relation to 
four hypothetical empirical values measured from other cir- 
cuits IC^-IC^ of identically designed netlists of transistors. 
From the FIG. 3 it is clear that there are variations in the lower 
and upper bounds of the configuration region Ac^^„ and Ac^^ 
50 for each of the circuits IC^-IC^. These variations are due to 
manufacturing tolerances that manifest themselves as physi- 
cally evident changes in the fabricated circuit, but from a 
digital standpoint the circuits IC^-IC^ are functionally iden- 
tical (or at least equivalent). So if a circuit is examined using 
55 an electron microscope, for example, very small differences 
can be seen chip-to-chip for a given circuit as well as with-in 
a single chip for multiple instance of some common reoccur- 
ring gate or circuit configuration. One or preferably both of 
Ac^,„ and Ac^^ are different than their respective endpoint 
60 values Ax^^„ and Ax^^^ so that the values of Ac^,„ and Ac^^ 
for each controlled gate or circuit 10 is measurable. Never- 
theless, the circuits IC^-IC^ are functionally identical from 
the aspect of the normal use which the circuit is intended to 
perform. But their fingerprints in terms of these differing 
65 values of and Ac^^ can be used to distinguish one 

instantiation of the circuit from another instantiation of the 
circuit. 
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A circuit is assembled as discrete components or more 
commonly as an integrated circuit (IC) in a semiconductor 
technology such as Complementary Metal Oxide Semicon- 
ductor (CMOS) having many instances of individual gates or 
circuits 10 each configured by an analog control voltage A 
whose respective values of Ac^j„ and Ac^^ serve to uniquely 
identify or fingerprint a particular chip. Because the values of 
Ac^,„ and Ac^^ for each controlled gate or circuit 10 result 
from manufacturing tolerances outside of manufacturing 
control, each individual chip will have many gates or circuits 
10 each of which has its own unique analog control or con- 
figuration voltage A which (i) must be set correctly (between 
Ac^^„ and Ac^^) and (ii) whose respective values of Ac^^„ 
and Ac^^ uniquely identify the chip in question. These volt- 
ages for each instance of a circuit 10 are generated by the 
associated DACs 12. So if the chip has m analog voltage 
controlled circuits 10, then each of the m DACs 12 must be 
loaded with a digital value which generates a respective volt- 
age between Ac^j„ andAc^^ for the chip to function properly 
and the digital values in each of the m DACs 12 which cause 
the respective gates or circuits 10 to malfunction when step- 
ping away from a nominal when the chip function properly 
can be used to uniquely identify or fingerprint the chip in 
question. 

The discussion so far has been primarily in terms of chips 
and particularly CMOS chips as they are commonly used in 
the manufacture of digital devices. But there is no reason why 
this fingerprinting scheme need be limited to chips since it 
should work well with anything (and everything) which is 
subject to manufacturing tolerances, which certainly includes 
discrete circuits. 

The discussion so far has also been primarily in terms of a 
circuit or gate 10 having one desirable function f and either 
one or two voltage range(s) for the analog control or configu- 
ration voltage A for which the function is undesirable or 
indeterminate. However, as is disclosed in the aforemen- 
tioned copending application Ser. No. 10/526,613, useful 
polymorphic gates can be made using evolutionary algo- 
rithms (EA) that are used to create embodiments of electronic 
circuits using varying topologies of transistors, various tran- 
sistor lengths and widths. Each such embodiment of a poly- 
morphic gate is defined as a netlist which describes the net- 
work of connections between transistors in a simple form. An 
embodiment created by the EA has a feature that when fab- 
ricated yields perhaps only one particular digital function f, 
but more preferably a range functions fg, f^, . . . f„ each 
separated by regions of indeterminate operation x as function 
of the magnitude of the analog control or configuration volt- 
age A. 

FIGS. 4a and 4b depict the effect of varying an analog 
control or configuration voltage A for eight polymorphic 
digital circuits fabricated on two separate fCs, chip 1 (FIG. 
4a) and chip 2 (FIG. 4b). The range of the control or configu- 
ration voltage A is shown from 0 Volt on the left to 1 .8 Volts 
on the right. Hatched regions indicate undefined or unstable 
functionality. FIG. 4c is an overlay of FIGS. 4a and 4b (with- 
out the hatched regions for clarity of illustration) showing the 
variability of the starting voltages (Ac^j„) and ending volt- 
ages (Ac^^ J for the respective functions of each of the eight 
gates. The gates are identified by the numbers 82, 87, 38, 100, 
30, 50, 44 and 59. 

The boundaries of functionality for the analog control or 
configuration voltage A were tested and are indicated by 
the regions marked fO . . . fn for chips 1 and 2. These regions 
correspond to separate potentially useful functions fg, 
fi, . . . f„ that each of the polymorphic gates can perform 
depending on the value of the analog control or configuration 
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voltage A applied thereto. So each gate can be thought of as 
being a gate or circuit 10 as in FIG. 1 having an associated 
DAC 12 for generating the analog control or configuration 
voltage A, but instead of having only one useful function f, 
5 each polymorphic gate can have several possible functions fg, 
f^, . . . 4 and has a lower and upper bounds of an associated 
configuration region Ac^j„ and Ac^^^ for each useful function 
f f f 

Note polymorphic circuit 82. It has seven different possible 
functions f0-f6. The value of Ac^^ for f6 is not distinguish- 
able from Ax^^ but the value of Ac^,„ is measurable as are 
the values of Ac^^.^ and Ac^^ for each of the functions f0-f5. 
So for polymorphic circuit 82, there are thirteen different 
values of the analog control or configuration voltage A which 
give a signature or fingerprint to that circuit 82. 

^ ^ Other gates or circuits represented by FIGS. 4a and 4b can 
have different numbers of possible functions and therefore 
different numbers of values of the analog control or configu- 
ration voltage A which give a signature or fingerprint to that 
gate or circuit. So increasing the number of fhnctions that a 
20 particular gate or circuit might perform just as increasing the 
number of circuits controlled by an analog control or configu- 
ration voltage A in a given chip (or discrete circuit) increases 
the complexity of the problem (by increasing the number of 
variables) thereby significantly reducing the possibility that 
25 any two chips (or discrete circuits) might have the same 
fingerprint (where each and every possible value of Ac^^„ and 
Ac^^ for each useful function fg, f^, . . . f„ of each and every 
separate gate or circuit having analog voltage control align 
perfectly within the precision of the DACs 12). It is rather 
30 easy to create sufficient complexity so that the chances of two 
chips (or discrete circuits) might have the same fingerprint 
will be less than one chance in 10^°. 

The measurability of the fluctuations in the values of Ac^ 
and Ac^^ whether measured as chip-to-chip variations as 
35 well as within-chip variations for the same circuit topology 
depends on (i) the precision of the DACs 12 and (ii) the 
standard deviations of the individual the fluctuations in the 
values of Ac^^„ andAc^^. Note the overlay diagram of FIG. 
4a and note more particularly polymorphic gate or circuit 87. 
40 Note functions 12, 13 and f4 of that gate and in particular note 
the variations in Ac^^„ and Ac^^ for those functions. One of 
the advantages of designing gates of a polymorphic structure 
is that circuits created through the use of EA can be made so 
that they inherently have measurable fluctuations in the val- 
45 ues of Ac^j„ and Ac^^ when measured as chip-to-chip varia- 
tions as well as within-chip variations for the same circuit 
topology. At the same time, there needs to exist a nominal 
value of A for each an analog controlled gate or circuit 1 0 such 
that the analog controlled gate or circuit 10 functions with a 
50 desired function f(which in the case of a polymorphic gate is 
a selected one of fimctions fo, fi, . . . f„) so that the DAC can 
be loaded with a number corresponding to the nominal value 
of A which enables the desired fimction f. Since the circuit in 
question will have many, many gates or circuits 10^_^ with 
55 associated DACs 12i_^, then key space which enables proper 
operation of the overall complex circuit 10 become rather 
large. If the key is not known, then the circuit 10 will not 
function properly. 

Note that all instantiations of the overall complex circuit 10 
60 will have the same key (i.e. the same nominal values of A1 .m), 
but their fingerprints will be different since they will not have 
the same values of Ac^j„ and Ac^^^ for each function f of each 
gate or circuit 10^_^. 

By the use of an evolutionary algorithm, such as that 
65 described in the aforementioned copending U. S . patent appli - 
cation Ser. No. 10/526,613, very tightly constrained design 
topologies can be found that provide consistent circuit/gate 



US 8,107,692 B2 


7 

functionality in the middle of the configured range (Ac^,„ and 
Ac^^) but have ill -defined configuration range boundaries 
(Ac^,„ and Ac^^ J when fabricated, the resulting circuits have 
both gross functionality that can be designated a priori to 
circuit fabrication and have fine detail that can be measured 
and are unique to each fabricated IC. 

Example of Unique Functionality: 

A set of circuits were evolved that exhibited multiple digi- 
tal functions depending on the value of a static analog con- 
figuration signal. These circuits were fabricated by Taiwan 
Semiconductor Manufacturing Corporation (TSMC) utiliz- 
ing a 0.18 micron feature size. Each digital circuit had two 
inputs, one output and one analog configuration input. The 
digital circuits were tested for functionality and the results are 
shown graphically in FIGS. 4a-4c described above and in 
tabular form in Table I appended hereto. FIGS. Aa and Ab 
show the minimum and maximum boundaries for eight sepa- 
rate digital circuits (arbitrarily labeled in the FIGS. 4a -4c) 
and for the different functions of each circuit. The overlay 
view of FIG. 4c shows how the variation between chip 1 and 
chip 2 manifests itself with regard to the configuration bound- 
aries. Examination of the overlapping regions leads to the 
conclusion that there are several boundaries of functionality 
that can be easily distinguished even without a very high 
precision DAC 12. 

Uniqueness: 

A further aspect of this technique is that the uniqueness of 
the circuits grows as the product of all boundaries of the 
analog control or configuration voltages on signal wires 14. In 
FIG. 2 there are only two boundaries, a minimum and a 
maximum. In principle there is no limit to the number of 
boundaries. In the example shown in FIGS. 4a and Ab there 
are thirteen boundaries shown for circuit 82, and there could 
be more still, depending on the solution found by the EA. 

An alternative technique for increasing the number of 
boundaries seen by a single signal wire 14 from a single DAC 
12 would be to connect the DAC 12 to more than one digital 
circuit. In this manner signal several boundaries could be 
probed. An example of this is shown in FIG. 5. In this figure 
signal A; on line 14 is connected to both gates or circuits gO 
and gl. The functional map for these two gates is shown in 
FIG. 6. In FIG. 6 it is shown that as the value of signal A^ is 
increased from Ac^^„ and Ac^^^, the system of the two gates/ 
circuits goes through two different functional regions, at first 
both outputs are undefined, then fO is enabled for circuit/gate 
gO, then becomes undefined, then fl is enabled on circuit/gate 
gl, then it becomes undefined again. In general, the two 
regions need not be separate, but may overlap to any degree, 
such as shown in FIG. 7. In the general manner described 
above, multiple gates can be connected to a single signal wire 
14. The effect of this is the same as that in the empirical tests 
shown in FIGS. 4a -4c above in that there are measurable 
differences between the functional boundaries as observed in 
different functionally-identical ICs. This effect is shown 
more clearly in FIG. 8 for the two-gate example of FIG. 5. 

The functional boundaries along the signal wire 14 of FIG. 
4 is shown in FIG. 9. In FIG. 9 there are two functional regions 
shown, Regl and Reg2. For the upper and lower boundaries 
of each of those regions there are two lines indicating the 
values for the respective functional boundary for two differ- 
ent ICs. In general there will be a distribution of boundary 
values for each functional region and it is expected that the 
distribution will be Gaussian. Also indicated in FIG. 9 is the 
anticipated Gaussian shape of the distribution for that bound- 
ary. For each functional boundary (lower and upper) there 
will be an observed distribution of values and a chi-square fit 
to the data will result in a different sigma of that distribution. 


8 

The values of sigma will determine the estimated boundaries 
within which the fabricated integrated circuits will perform 
the given function. It is also notable that the width of each 
functional region (i.e. the difference between Rx^ and Rx^ — 
5 which correspond to Ac^^.„ to Ac^^^ discussed above — for the 
region under consideration) should be designed or selected so 
that it is larger than the sigma of the boundary distributions, 
otherwise there is no guarantee that the gross functionality 
will be exhibited by any particular IC and makes testing much 
more difficult. 

Multiplicity of the Signature: 

The ability to extract a signature from a set of signal 
domains such as that shown in FIG. 9 depends on two param- 
eters, the sigma of the boundary value distribution, and the 
sigma of the measurement resolution. This is illustrated in 
FIG. 1 0 in which a mean boundary R is shown in between two 
measurement points and the sigma of the distribution of the 
boundary R (shown with infinite precision) is shown as sub- 
20 tending two measurement points (as defined by the precision 
of the DAC 12). In this case the level of detail obtainable for 
that element of the signature is limited to only two values. In 
general, the level of detail in the signature is defined as the 
number of measurement points (and hence the precision of or 
25 number of bits in the DAC 14) subtended by the sigma of the 
boundary value distribution. 

For a distribution with sigma of about V 256 of the range of 
the analog signal input and a desired number of discemable 
values within that range of about 4, a measurement precision 
of 10 bits is required. For example, the actual IC measured 
and shown in FIGS. 4a-4c would correspond to a sigma of 7 
mV and a DAC precision of -1.76 mV. Such measurements 
taken on-chip are routine and do not require any extraordinary 
effort. An empirical study was made for four ICs with func- 
tionally identical circuits. The mean variation across all four 
ICs tested was 8 mV. However, as shown in FIG. 11, a sig- 
nificant number of boundaries are found near the mean of the 
distribution, and if those boundaries are not used for signature 
40 detection, the precision requirement for the measurement can 
be reduced. For instance, in the data analyzed, if the variation 
between the average boundary value and a specific boundary 
value is 10 mV or more, we see that there are 17 boundaries 
that match that requirement out of a possible 70. A distribu- 
45 tion was generated in which the same sigma as determined 
empirically from FIG. 11 was used to produce a statistically 
relevant sample of random data on a normal distribution. This 
data was then binned at a 7 mV increment, which corresponds 
to an 8-bit resolution DAC. This data was then sampled and 
50 the likelihood of that distribution producing two identical 
fingerprints was plotted as a lunction of the number of bound- 
aries in the system. The plot is shown in FIG. 16. FIG. 16 
shows that there is a strongly exponential drop in the prob- 
ability of two identical chips while testing with DACs of 8-bit 
55 precision. When there are just 1 7 boundaries the probability is 
1 E-5 . Continuing along this predicted path, the probability of 
finding two identical chips with 40 boundaries is 1 E-1 1 and it 
will reach lE-40 with 125 boundaries. The expectation is that 
we will be able to achieve 125 boundaries with about 30 
60 polymorphic gates, which is a very small number in relation 
to the total number of gates or equivalent transistors on an 
integrated circuit. 

Temperature Dependence: 

It is known that there is strong temperature dependence for 
65 the analog functionality of integrated circuits. It is expected 
that there will also be a temperature shift of the functional 
boundaries of the circuits disclosed herein. This measurement 
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has not been done at this point, but it is expected that such a 
measurement will lead to a correction table for the boundary 
values. 

The Configuration Parameter: Other Fingerprint Domains 

The configuration parameter in the foregoing description is 
a static analog voltage, but there are other analog domains that 
can be interpreted and converted to the digital function 
domain. Examples of these are given in this non- inclusive list: 
frequency, time, current, temperature, pressure, flux of ioniz- 
ing radiation, electrical load. 

As such, the configuration parameter need not necessarily 
be voltage related. For example, some GaN devices are sen- 
sitive to changes in pressure in terms of changing their func- 
tionality. Also, the present invention has been described in 
terms of using CMOS technologies, and those skilled in the 
art will appreciate the relationship between using voltage 
control and CMOS. And while CMOS gates and circuits are 
commonly used in digital technology, there is no reason for 
necessarily excluding bipolar devices, for example, from con- 
sideration. In bipolar devices the configuration parameter can 
be represented by a current value rather than a voltage value. 
Using AE, the configuration parameter can also be a fre- 
quency or electrical load, so that a circuit designed using AE, 
if the frequency of the analog input changes or alternatively if 
the load changes, the function performed by the circuit 
changes. 

So while this technology has been described using embodi- 
ments where the configuration parameter is voltage-related, it 
should be appreciated that the configuration parameter can be 
pressure, load, current, frequency, and/or voltage related. 

An Exemplary Polymorphic Gate 

FIG. 12 depicts a polymorphic gate 10 which takes on six 
different useful functions (which are separated by non-func- 
tional regions) in response to changing its bias voltage (which 
is shown as signal ‘Select’ in the figure). So if the DAC 12 is 
utilized to generate the analog voltage on wire 14 which is 
connected to signal Select, then by applying numbers to the 
associated DAC, the boundary conditions associated with the 
depicted polymorphic gate 10 can be determined as described 
above. 

Extracting the Numeric Values of the Boundary Conditions 

Given a suitably complex circuit having a thousand circuits 
each having six boundary conditions, there could easily be 
10^^ boundary conditions which could be examined. Assume, 
for example, that the circuit in shown in FIG. 13 has a thou- 
sand or more black box gates lO^.^oco opposed to five 
depicted black box gates 10^ and assume that each black box 
gate has more than just a few boundary conditions associated 
therewith since polymorphic gates are preferably utilized. 
Such a complex circuit has a large set of possible boundary 
conditions and having a large set of possible boundary con- 
ditions which could be examined helps to ensure that a device 
using this technology cannot be spoofed, since it takes a finite 
amount of time to determine even one boundary condition, 
the prospect of examining all of them reasonably quickly 
becomes an impossibility. This space (of all possible bound- 
ary conditions) is labeled 200 in FIG. 14. 

So instead of examining all of them, some reasonably sized 
subset of all of the possible boundary conditions is examined 
by first setting all of the configuration inputs Aq, A^, . . . A^.^ 
to their nominal working values (Ac„^^ which is typically 
midway between Ac^j„ and Ac^^^ for the function f to be 
tested). This space is labeled 202 in FIG. 14. Then for each of 
the configuration inputs to be tested, the configuration input 
value A is adjusted using a stepping algorithm designed to 
quickly find the associated values ofAc^j„ andAc^^^ (assum- 
ing that both Ac^,„ and Ac^^ are of interest) discussed in 
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greater detail below. This process is repeated for each func- 
tion f associated with each configuration input Aq, 
Ai, . . . A^_i to be tested to arrive at the set of numeric values 
which define the reasonably sized subset of all of the possible 
5 boundary conditions. The numeric values preferably corre- 
spond to the values taken by the DACs 14 when (or immedi- 
ately before) the complex circuit produces an anomalous 
result based on inputted hypothetical data to the complex 
circuit. Assume that 1014 of the 1040 boundary conditions 
10 are actually measured (and stored for safe keeping) for a, 
particular instantiation of the complex circuit. See space 202 
in FIG. 14. 

After a particular instantiation of the complex circuit is the 
released into the “wild” in a piece of military or commercially 
15 sensitive equipment, the piece of military or commercially 
sensitive equipment can be tested to determine whether the 
original instantiation of the complex circuit still resides in the 
piece of military or commercially sensitive equipment. Test- 
ing one to two thousand of the boundary conditions should be 
20 enough to satisfying one with a high degree of certainty that 
either the original complex circuit is still in place or alert one 
to the fact that the original complex circuit has been replaced 
with a rogue version of same. This space is labeled 204 in 
FIG. 14. Since a reverse engineer who got access to the 
25 complex circuit would not know which subset 202 of the set 
200 of all possible boundary conditions had been tested, the 
reverse engineer would be forced to try to find every member 
of set 200 if they are to successfully spoof the complex circuit 
so that it returns the expected values when the subset 204 is 
30 tested. 

FIG. 15 depicts two gates each having a single function f 
having an associated configured range (Ac^^„ and Ac^^ J. For 
ease of description, the subscripts in this figure for the bound- 
aries B are i.j, where i refers subscript of the corresponding 
35 gate g and j is 0 for Ac^^.„ and 1 for Ac^^^. The procedure for 
identifying the set of fingerprints involves: 

1 . Set St to approximately (B^ ^-B^ q)/ 2 (i.e., the mid-point 
of range A^) where these range boundaries are estimated 
because they were inputs to the EA. 

40 2. Search downward for SO to identity when the overall 

function F(I) no longer corresponds to the intended 
function, this search is performed using the so-called 
“binary search” method. The result of this search is 
fingerprint data Bq o- 

45 3 . Search upward to identify Bq i in a manner symmetric to 

the above. 

4. Set SO to (Bq ^-Bq q)/2 using the measured values of Bq ^ 
and Bo o- 

5. Search for boundaries B^ q and B^ ^ in a fashion repeat- 
50 ing the algorithm above. 

The foregoing Detailed Description of exemplary and pre- 
ferred embodiments is presented for purposes of illustration 
and disclosure in accordance with the requirements of the 
law. It is not intended to be exhaustive nor to limit the inven- 
55 tion to the precise form(s) described, but only to enable others 
skilled in the art to understand how the invention may be 
suited for a particular use or implementation. The possibility 
of modifications and variations will be apparent to those 
skilled in the art. No limitation is intended by the description 
60 of exemplary embodiments which may have included toler- 
ances, feature dimensions, specific operating conditions, 
engineering specifications, or the like, and which may vary 
between implementations or with changes to the state of the 
art, and no limitation should be implied there from. Applicant 
65 has made this disclosure with respect to the current state of the 
art, but also contemplate advancements and that adaptations 
in the future may take into consideration of those advance- 
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ments, namely in accordance with the then current state of the 
art. It is intended that the scope of the invention be defined by 
the Claims as written and equivalents as applicable. Refer- 
ence to a claim element in the singular is not intended to mean 
“one and only one” unless explicitly so stated. Moreover, no 5 
element, component, nor method or process step in this dis- 
closure is intended to be dedicated to the public regardless of 
whether the element, component, or step is explicitly recited 
in the Claims. No claim element herein is to be construed 
under the provisions of 35 U.S.C. Sec. 1 12, sixth paragraph, 10 
unless the element is expressly recited using the phrase 
“means for ...” and no method or process step herein is to be 
construed under those provisions unless the step, or steps, are 
expressly recited using the phrase “comprising the step(s) o 
for . . . ”. V 
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at least one other state wherein the intended digital func- 
tion is not performed; 

response to the configuration voltage applied to the ana- 
log input for controlling the performance of the 
intended digital function of the circuit or gate; and 

a transition between the at least one state and the at least 
one other state when the applied configuration voltage 
corresponds to a boundary voltage wherein the 
boundary voltage for each instantiation of the system 
constitute a fingerprint for identification of said each 
instantiation. 

2 . The system of claim 1 wherein manufacturing tolerances 
occurring during manufacture of said system give rise to the 
/arying of said boundary voltages. 


What is claimed is: 

1. A system comprising: 

at least one digital to analog converter for generating con- 
figuration voltages and 60 

a plurality of digital circuits or gates, wherein each of the 
plurality of digital circuits or gates comprises an analog 
input to which the configuration voltages are adapted to 
be applied, and the digital circuit or gate is adapted to 
exhibit, during operation: 65 

at least one state wherein the digital circuit or gate per- 
forms an intended digital fimction; 


3. The system of claim 1 wherein the boundary voltage of 
a particular digital circuit or gate corresponds to a number 
applied to the associated digital to analog converter for gen- 
erating the configuration voltage corresponding to the bound- 
ary voltage associated with said particular digital circuit or 
gate. 

4. The system of claim 1 wherein said system is an inte- 
grated circuit device. 

5. The system of claim 1, fiirther comprising an electrical 
circuit for testing the boundary voltage and thereby extracting 
the fingerprint from the particular instantiation of the system. 
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6. The system of claim 5, wherein the system is an inte- 
grated circuit device. 

7. The system of claim 6, wherein the configuration volt- 
ages are DC or AC voltages applied to the integrated circuit 
device. 

8. A system comprising: 

at least one digital to analog converter for generating con- 
figuration voltages and 

at least one polymorphic circuit, wherein the polymorphic 
circuit comprises an analog input to which the configu- 
ration voltages are adapted to be applied, and the poly- 
morphic circuit is adapted to exhibit, during operation: 
at least two states wherein the polymorphic circuit per- 
forms one intended digital function for each state; 
at least one other state occurring between the at least two 
states wherein the intended digital functions are not 
performed; 

response to the configuration voltage applied to the ana- 
log input for controlling the performance of the 
intended digital functions of the polymorphic circuit; 
and 
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at least two transitions, wherein each transition is 
between one of the at least two states and the at least 
one other state when the applied configuration voltage 
corresponds to a boundary voltage of the polymorphic 

5 circuit, wherein the boundary voltages for each 

instantiation of the system constitute fingerprints for 
identification of said each instantiation. 

9 . The system of claim 8 wherein the polymorphic circuit is 
configured to have at least five boundary voltages where the 

10 polymorphic circuit transitions from one of the at least two 
states to the at least one other state. 

10. The system of claim 9 wherein each boundary voltage 
of a particular polymorphic circuit corresponds to a number 
applied to the associated digital to analog converter for gen- 

15 erating the configuration voltage corresponding to each 
boundary voltage associated with said particular polymor- 
phic circuit. 



